Policy

Configure Remote Encryption Protection Mode

Windows 11 25H2

Back to categoryOpen picker

Policy overview

Key metadata and intent for this policy.

ClassComputer
CategoryWindows Components > Microsoft Defender Antivirus > Remediation > Behavioral Network Blocks > Remote Encryption Protection
Supported onAt least Windows Server 2016, Windows 10 Version 1607

Supported OS tags: Windows10, Windows10RT, Windows11, WindowsServer2016

Set the mode for Remote Encryption Protection in Microsoft Defender Antivirus, which can detect and block attempts to replace local files with encrypted versions from another device. Supported settings: * 0 - Not configured or Default: Apply defaults, which can vary depending on the antivirus engine version and the platform * 1 - Block: Prevent suspicious and malicious behaviors * 2 - Audit: Generate EDR detections without blocking * 4 - Off: Feature is off with no performance impact

Internal name
Remediation_BNB_REP_RemoteEncryptionProtection_ConfiguredState
Policy ID
fa8e5866d7dc
Elements
1

Registry values

How enabled and disabled states update the registry.

No explicit registry values are set for enabled or disabled states.

Policy elements

Inputs and configuration options exposed by this policy.

ElementTypeRegistry mappingConstraints & behavior
Specify the state of Remote Encryption Protection
ID Remediation_BNB_REP_RemoteEncryptionProtection_ConfiguredState
enum
HKLM\Software\Policies\Microsoft\Windows Defender\Remediation\Behavioral Network Blocks\Remote Encryption Protection\RemoteEncryptionProtectionConfiguredState
Type REG_DWORD
Options: Default (0), Block (1), Audit (2), Off (4)

Other policies in this category

Explore related policies at the same level.